﻿#pragma once
//#pragma pack(push, 1)
#include <windows.h>
#include <iostream>
#include <vector>
#include <map>
#include "NtfsStructs.h"

#define RET_EEFAULT_ERROR -1 //返回默认错误码
#define RET_EEFAULT_CORRECT 0 //返回默认正确码

#define SECTOR_SIZE 512 // 扇区大小（单位：字节）
#define MFTITEM_SIZE 1024 //一个MFT项大小（单位：字节）
#define ATTRIBUTE_NAME_SIZE 8 //索引名称大小（单位：字节）
#define FILENAME_MAX_LEN 255 //文件名最大长度

typedef enum _DriveStatus
{
	DriveStatus_Closed = 0,
	DriveStatus_Opened
}DriveStatus;

typedef struct _DriveBase
{
	std::wstring m_wsPath;
	std::wstring m_wsName;
}DriveBase, *PDriveBase;

typedef struct _Drive : public DriveBase
{
	HANDLE m_hVolume;
	DriveStatus m_iStatus;
	BootSector m_boot;
	LARGE_INTEGER m_lMFTOffset; //主文件表MFT偏移
	FileRecordHead m_MFTHead;   //主文件表MFT信息
	//LARGE_INTEGER m_lRootDirMFTOffset; //RootDir的MFT偏移
	//LARGE_INTEGER m_lRootDirIndexOffset; //RootDir的Index偏移
}Drive, *PDrive;

typedef struct _File
{
	std::wstring m_wsPath; //文件路径
	std::wstring m_wsName; //文件名

	Drive *m_pDrive; //分区信息
	uint64_t m_uMFTNo;//mft号
	uint64_t m_uParentClusterNo; //父节点簇号
	uint64_t m_uParentMFTNo; //父节点mft号
}File, *PFile;

typedef struct _DriveInfo
{
	std::wstring m_wsPath; //路径
	std::wstring m_wsName; //名字
	std::wstring m_fsType; //文件系统类型
	uint64_t m_iSize;      //分区大小
}DriveInfo, *PDriveInfo;

typedef struct _FileInfo
{
	std::wstring m_wsPath; //文件路径
	std::wstring m_wsName; //文件名
	uint64_t m_iSize;      //文件大小
	
}FileInfo, *PFileInfo;

//#pragma pack(pop)

static void char2wstring(char* _cpStr, std::wstring& _wstrStr);
static int splitFilePath(const std::wstring& _wstrFilePath, std::vector<std::wstring>& _vecPathList);

class NtfsParse
{
public:
	static NtfsParse *GetInstance();
	~NtfsParse();
	int GetDrives(std::vector<DriveInfo> &_vecDrives);
	int GetFileList(const std::wstring &_wstrDriveName, std::vector<FileInfo> &_vecFileList);

private:
	NtfsParse();
	void Init();
	int OpenDrive(const std::wstring &_wstrDriveName, HANDLE &_hVolume);
	int GetBoot(Drive &_drive);
	int GetMFTOffset(Drive &_drive);

	int ParseFile(uint32_t _uMFTNo, Drive& _drive, std::vector<File> &_vecFileList);
	int ParseMFT(uint32_t _uMFTNo, Drive& _drive, std::vector<std::pair<uint64_t, uint16_t>> &_vecRunlist, std::vector<File> &_vecFiles);
	uint32_t Parse10H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t Parse20H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive, std::vector<std::pair<uint64_t, uint16_t>>& _vecRunlist, std::vector<File> &_vecFiles);
	uint32_t Parse30H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t Parse40H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t Parse50H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t Parse60H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t Parse70H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t Parse80H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t Parse90H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive, std::vector<File> &_vecFiles);
	uint32_t ParseA0H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive, std::vector<std::pair<uint64_t, uint16_t>> &_vecRunlist);
	uint32_t ParseB0H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t ParseC0H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t ParseD0H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t ParseE0H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	uint32_t Parse100H(char* _pBuf, uint16_t _uMFTNo, Drive& _drive);
	int ParseIndex(uint64_t _uClusterNo, uint64_t _uClusterSize, Drive& _drive, std::vector<File> &_vecFiles);
	
private:
	static NtfsParse* m_pObj;
	std::vector<Drive> m_vecDrives;//所有分区信息
	std::map<std::wstring, int> m_mapDriveIndex;//分区索引
	std::map<uint16_t, File> m_mapFileIndex; //文件索引
	
};


